   save-certificate-request!
   "Write the subject's certificate request to disk under the CSR directory."
   [subject :- schema/Str
-   csr :- (schema/pred utils/certificate-request?)
+   csr :- CertificateRequest
    csrdir :- schema/Str]
   (utils/obj->pem! csr (path-to-cert-request csrdir subject)))
 

   master-certname :- schema/Str
   ca-private-key :- (schema/pred utils/private-key?)
   ca-public-key :- (schema/pred utils/public-key?)
   ca-cert :- (schema/pred utils/certificate?)
   keylength :- schema/Int
   serial-file :- schema/Str
   inventory-file :- schema/Str

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;; certificate_status endpoint

(schema/defn certificate-state :- CertificateState
  "Determine the state a certificate is in."
  [cert-or-csr :- (schema/either Certificate CertificateRequest)
   cacrl :- schema/Str]
  (if (utils/certificate-request? cert-or-csr)
    "requested"
    (if (utils/revoked? (utils/pem->crl cacrl) cert-or-csr)
      "revoked"
      "signed")))

(schema/defn dns-alt-names :- [schema/Str]
  "Get the list of DNS alt names on the provided certificate or CSR.
   Each name will be prepended with 'DNS:'."
  [cert-or-csr :- (schema/either Certificate CertificateRequest)]
  (mapv (partial str "DNS:")
        (utils/get-subject-dns-alt-names cert-or-csr)))

(schema/defn fingerprint :- schema/Str
  "Calculate the hash of the certificate or CSR using the given
   algorithm, which must be one of SHA-1, SHA-256, or SHA-512."
  [cert-or-csr :- (schema/either Certificate CertificateRequest)
   algorithm :- schema/Str]
  (->> (utils/fingerprint cert-or-csr algorithm)
       (partition 2)
       (map (partial apply str))
       (str/join ":")
       (str/upper-case)))

(schema/defn ^:always-validate get-certificate-status :- CertStatus
  "Get the status of the subject's certificate or certificate request.
   The status includes the state of the certificate (signed, revoked, requested),
   DNS alt names, and several different fingerprint hashes of the certificate."
  [{:keys [csrdir signeddir cacrl]} :- CaSettings
   subject :- schema/Str]
  (let [cert-or-csr         (if (fs/exists? (path-to-cert signeddir subject))
